From 80757fa1d8b596e5471f410734ba24a73c3d4d5e Mon Sep 17 00:00:00 2001
From: Finn Stutzenstein <me@finn.st>
Date: Wed, 21 Oct 2026 15:25:38 +0000
Subject: [PATCH] Fix HTTP 500 on missing email or domain when creating users
 and aliases

If the email or domain field was missing or invalid, the error was
flashed, but the address was still built from the unset attributes,
which raised an AttributeError. Only build and validate the address
if both are set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 max/routes/alias/create.py | 19 ++++++++++---------
 max/routes/user/create.py  |  7 ++++---
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/max/routes/alias/create.py b/max/routes/alias/create.py
index 2e7bd8a..0c298c5 100644
--- a/max/routes/alias/create.py
+++ b/max/routes/alias/create.py
@@ -39,15 +39,16 @@ class AliasCreate(
         else:
             self.domain = self.get_user_domain()
 
-        full_email = f"{self.email}@{self.domain}"
-        if not self.is_email_valid(full_email):
-            error = True
-        elif not self.auth_user.is_admin and self.is_reserved_email(full_email):
-            flash(
-                t("This address is reserved and can only be created by an admin."),
-                category="error",
-            )
-            error = True
+        if not error:
+            full_email = f"{self.email}@{self.domain}"
+            if not self.is_email_valid(full_email):
+                error = True
+            elif not self.auth_user.is_admin and self.is_reserved_email(full_email):
+                flash(
+                    t("This address is reserved and can only be created by an admin."),
+                    category="error",
+                )
+                error = True
 
         enabled = self.request.form.get("enabled")
         if enabled == "on":
diff --git a/max/routes/user/create.py b/max/routes/user/create.py
index dc56134..cc1c580 100644
--- a/max/routes/user/create.py
+++ b/max/routes/user/create.py
@@ -32,9 +32,10 @@ class UserCreate(AllowAdmin, CheckEmailMixin, BackToUsersMixin, BaseTemplateGetV
         else:
             self.domain = domain
 
-        full_email = f"{self.email}@{self.domain}"
-        if not self.is_email_valid(full_email):
-            error = True
+        if not error:
+            full_email = f"{self.email}@{self.domain}"
+            if not self.is_email_valid(full_email):
+                error = True
 
         pw1 = self.request.form.get("password1")
         pw2 = self.request.form.get("password2")